<html><head><base href="x-msg://63/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div>We use ACME Packet SBCs at the edge, and everything else is in a private network, with some edge security devices for command/control/admin.</div><div><br></div><div>The ACMEs have some excellent features in terms of a 'trust' model. So a successfully registered device moves into a higher trust level, which can do more transactions per second etc. Non-registered devices have a limited set of transactions. If you 'break' your limit you get demoted, and if you fall beyond 'untrusted' you get blocked for a configurable period of time.</div><div><br></div><div>This prevents brute forcing of passwords etc.</div><div><br></div><div>We also limit voice traffic to particular known bad locations, alarm on qtys of calls to suspect locations, alarm on cost thresholds to locations etc, limit qtys of concurrent redirections per subscriber etc..</div><div><br></div><div>ACMEs are amazing bits of kit. The ACMEs handle a lot of the load, remove most of the crap, do registration caching (removing load on your register servers), and do beautiful things like hosted nat traversal.</div><div><br></div><div>YMMV.</div><div><br></div><br><div><div>On 27/09/2010, at 11:43 PM, Skeeve Stevens wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div lang="EN-AU" link="blue" vlink="purple"><div class="WordSection1" style="page: WordSection1; "><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); ">Hey all,<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); ">I’ve got a few customers who have noticed a large recent jump in SIP scans against their networks.<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); ">Null routing helps the response but doesn’t stop the registration initiation – loading up servers with registrations.<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); ">This is easy to stop on closed VoIP systems, but not on hosted Voice platforms which users come from other ISP’s/networks, this seems to be very difficult.<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); ">Does anyone have any ideas – we are fresh out at the moment, apart from beefing up security on the VoIP servers themselves using fail2ban or other things that detect rapid registrations and then firewalls them.<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); ">Having a normal server hacked is one thing but VoIP hacking has taken on a new intensity as the hackers can make a LARGE amount of money by comprising a VoIP system.<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); ">Recently, we’ve been brought in to clean up the mess in several incidents where a couple of VoIP systems have been compromised in incidents totalling over AU$100,000.<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); ">And the carriers are rarely sympathetic.<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); ">If it isn’t obvious as to how/why they’re doing this – the hackers get in, open a SIP account so their VoIP system can register, and then they channel certain calls via the comprised system. This has the effect of them charging the end user and making money, while not paying for the calls to be delivered to the destination.<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); ">Advice:<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 36pt; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -18pt; "><span style="color: rgb(0, 32, 96); "><span>-<span style="font: normal normal normal 7pt/normal 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span></span><span style="color: rgb(0, 32, 96); ">Block destinations to obscure places that your customers are unlikely to call, and only unblock them if they request<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 36pt; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -18pt; "><span style="color: rgb(0, 32, 96); "><span>-<span style="font: normal normal normal 7pt/normal 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span></span><span style="color: rgb(0, 32, 96); ">Watch billing to certain locations and if there is a massive jump, do something<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 36pt; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -18pt; "><span style="color: rgb(0, 32, 96); "><span>-<span style="font: normal normal normal 7pt/normal 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span></span><span style="color: rgb(0, 32, 96); ">Watch your customers and if their billing jumps by a massive amount, alert them as fast as you can – or you just might be liable<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; color: rgb(0, 32, 96); "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(31, 73, 125); ">...Skeeve<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; color: rgb(0, 32, 96); "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; color: rgb(0, 32, 96); ">--<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; color: rgb(0, 32, 96); ">Skeeve Stevens, CEO<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; color: rgb(0, 32, 96); ">eintellego Pty Ltd - The Networking Specialists<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; color: rgb(0, 32, 96); "><a href="mailto:skeeve@eintellego.net" style="color: blue; text-decoration: underline; ">skeeve@eintellego.net</a><span class="Apple-converted-space"> </span>/<span class="Apple-converted-space"> </span><a href="http://www.eintellego.net" style="color: blue; text-decoration: underline; ">www.eintellego.net</a><o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; color: rgb(0, 32, 96); ">Phone: 1300 753 383, Fax: (+612) 8572 9954<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; color: rgb(0, 32, 96); ">Cell +61 (0)414 753 383 /<span class="Apple-converted-space"> </span><a href="skype://skeeve" style="color: blue; text-decoration: underline; ">skype://skeeve</a><o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; color: rgb(0, 32, 96); "><a href="http://www.linkedin.com/in/skeeve" style="color: blue; text-decoration: underline; ">www.linkedin.com/in/skeeve</a><span class="Apple-converted-space"> </span>;<span class="Apple-converted-space"> </span><a href="http://facebook.com/eintellego" style="color: blue; text-decoration: underline; ">facebook.com/eintellego</a><o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; color: rgb(0, 32, 96); ">--<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; color: rgb(0, 32, 96); ">eintellego - The Experts that the Experts call<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 10pt; color: rgb(0, 32, 96); ">- Juniper - HP Networking - Cisco - Arista -<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="color: rgb(0, 32, 96); "><o:p> </o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 8pt; color: rgb(0, 32, 96); ">Disclaimer: Limits of Liability and Disclaimer: This message is for the named person's use only. It may contain sensitive and private proprietary or legally privileged information. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. eintellego Pty Ltd and each legal entity in the Tefilah Pty Ltd group of companies reserve the right to monitor all e-mail communications through its networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of any such entity. Any reference to costs, fee quotations, contractual transactions and variations to contract terms is subject to separate confirmation in writing signed by an authorised representative of eintellego. Whilst all efforts are made to safeguard inbound and outbound e-mails, we cannot guarantee that attachments are virus-free or compatible with your systems and do not accept any liability in respect of viruses or computer problems experienced.<o:p></o:p></span></div><div style="margin-top: 0cm; margin-right: 0cm; margin-bottom: 0.0001pt; margin-left: 0cm; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div></div><span><ATT00001..txt></span></div></span></blockquote></div><br></body></html>